§1.1 Field of the Invention
The present invention concerns sampling addressed data (referred to as “packets” in the specification without loss of generality). More specifically, the present invention concerns forwarding packet samples to a specified next hop.
§1.2 Description of Related Art
The description of art in this section is not, and should not be interpreted to be, an admission that such art is prior art to the present invention.
§1.2.1 Networks, Inter-Networks, and the Need for Sampling
Many networks are made up of interconnected nodes (referred to as “routers” in the specification below without loss of generality) for forwarding addressed data (referred to as “packets” in the specification below without loss of generality). The routers may be geographically distributed throughout a region and connected by links (e.g., optical fiber, copper cable, wireless transmission channels, etc.). In such a network, each router typically interfaces with (e.g., terminates) multiple input links and multiple output links. Packets traverse the network by being forwarded from router to router until they reach their destinations (as typically specified in so-called layer-3 addresses in the packet headers). Unlike switches, which establish a connection for the duration of a “call” or “session” to send data received on a given input port out on a given output port, routers determine the destination addresses of received (ingress) packets and, based on these destination addresses, determine, in each case, the appropriate output link on which to send them. The address of the next node (layer 2 address) is often referred to as a “next hop” address. The interface terminating the particular output link may be referred to as a “next hop” interface. Since, unlike switches, routers are not connection-based—packets having the same destination address may actually traverse different paths through the network.
Samples of the packets passing through a particular router, or a particular group of routers, may be generated for example, for use in traffic analysis, or for examination by a regulatory authority.
§1.2.2 Challenges to Gathering Data for Network Analysis
Forwarding devices, such as routers, may be equipped to sample packets, or at least header information in such packets, accepted and forwarded. Such samples may be forwarded to another device. To get the samples to the other device, the samples may be (i) provided with a particular (layer 3) destination address (not needed for point-to-point connections), (ii) provided with a particular “next hop” (layer 2) address, and/or (iii) sent out on a particular interface (or port) associated with the next hop (layer 2) address. Typically, the interface or port terminates a physical link. If the physical port or link goes down, samples may be lost. Further, in a typical router, a particular IP (layer 3) destination address will have an associated next hop (layer 2) destination address and an associated output interface. These associations may be determined by a routing protocol for example. Such routing protocols typically determine routes based on continuously updated network topology information. If this network topology information changes, the association of a particular IP (layer 3) address to a particular next hop (layer 2) destination address and output port may become unstable or unresolved. Thus, there is a possibility that samples may be sent, inadvertently, to the wrong place. If the sampling is done at line rate and the router handles relatively fast rates, it may be impractical to buffer such samples while the next hop is being resolved. Accordingly, there is a need to avoid sending samples to an improper address, or out an improper port.